Apply CAA exchange timeout per label

A single dnsExchangeTimeout around CheckCAA let slow empty
answers at child names consume the budget before parent
policy was queried. Give each label its own exchange timeout
inside the climb instead.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/certmanager/provision_worker.go

@@ -348,10 +348,9 @@ func (h *beginChallengeHandler) loadSkipDNSChecks(ctx context.Context, hostname
 }
 
 func (h *beginChallengeHandler) checkCAARecords(ctx context.Context, hostname string) error {
-	dnsCtx, cancel := context.WithTimeout(ctx, dnsExchangeTimeout)
-	defer cancel()
-
-	err := h.dnsClient.CheckCAA(dnsCtx, hostname, h.caaIssuerDomain)
+	// Exchange timeouts are applied per CAA label inside dnsclient.CheckCAA so
+	// the parent-climb budget is not shared across every lookup.
+	err := h.dnsClient.CheckCAA(ctx, hostname, h.caaIssuerDomain)
 	if err == nil {
 		return nil
 	}